MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Microsoft Purview Data Loss Prevention (DLP)

  Why this is correct

  DLP policies are content-aware and use built-in sensitive information types, such as regex patterns for Social Security numbers, to scan emails, documents, and chats across Exchange Online, SharePoint, and Teams. When a match occurs, DLP can automatically block the message from being sent or the file from being shared, while also showing a policy tip to the user and alerting the compliance officer. This provides real-time, automated detection and remediation of sensitive data sharing, which is exactly the requirement.

• ✗

  Microsoft Purview Insider Risk Management

  Why it's wrong here

  Insider Risk Management uses behavioral signals like mass file downloads, unusual external sharing, or repeated access to restricted sites to calculate risk scores for users, but it does not inspect the actual content for specific data types such as SSNs. It serves as a risk analytics and investigation tool that uncovers suspicious user patterns and supports case management, but it cannot proactively block an email or a document sharing action at the moment it occurs. Therefore, it is a valuable complement to DLP, not a substitute for its inline content enforcement.

• ✗

  Microsoft Purview Communication Compliance

  Why it's wrong here

  Communication Compliance is designed to monitor and analyze communications for policy violations like offensive language, harassment, or sharing confidential information in a conversational context, using trainable classifiers and machine learning models. It focuses on user behavior in messages and meetings and is not designed to scan for structured sensitive data such as Social Security numbers or to enforce automatic blocking of data sharing. Its primary output is alerts for review and remediation, not real-time prevention of specific data types.

• ✗

  Microsoft Purview Audit

  Why it's wrong here

  Microsoft Purview Audit is a forensics and compliance investigation tool that records a unified audit log of user and administrative activities, such as when a file was accessed, modified, or shared, and who performed the action. It is reactive by nature, enabling investigators to reconstruct events after the fact, but it does not proactively inspect the content of communications or documents and cannot automatically block a transmission. The audit log only provides evidence for investigation, so it cannot meet the requirement for automatic detection at the point of sharing.

Go deeper

Related to this question